...

DRAFT REGULATORY GUIDE DG-1172 DRAFT REGULATORY GUIDE

by user

on
Category: Documents
10

views

Report

Comments

Transcript

DRAFT REGULATORY GUIDE DG-1172 DRAFT REGULATORY GUIDE
U.S. NUCLEAR REGULATORY COMMISSION
OFFICE OF NUCLEAR REGULATORY RESEARCH
November 2006
Division 1
DRAFT REGULATORY GUIDE
Contact: S.K. Aggarwal
(301) 415-6005
DRAFT REGULATORY GUIDE DG-1172
(Proposed Revision 4 of Regulatory Guide 1.9, dated July 1993)
APPLICATION AND TESTING
OF SAFETY-RELATED DIESEL GENERATORS
IN NUCLEAR POWER PLANTS
A. INTRODUCTION
General Design Criterion 17, “Electric Power Systems,” of Appendix A, “General Design Criteria
for Nuclear Power Plants,” to Title 10, Part 50, of the Code of Federal Regulations (10 CFR Part 50),
“Domestic Licensing of Production and Utilization Facilities,” requires that onsite electric power systems
have sufficient independence, capacity, capability, redundancy, and testability to ensure that
(1) specified acceptable nuclear fuel design limits and design conditions of the reactor coolant pressure
boundary are not exceeded as a result of anticipated operational occurrences, and (2) the core is cooled
and containment integrity and other vital functions are maintained in the event of postulated accidents,
assuming a single failure.
General Design Criterion 18, “Inspection and Testing of Electric Power Systems,” of Appendix A
to 10 CFR Part 50 requires that electric power systems important to safety be designed to permit
appropriate periodic inspection and testing to assess the continuity of the systems and the condition
of their components.
Criterion III, “Design Control,” and Criterion XI, “Test Control,” of Appendix B, “Quality
Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants,” to 10 CFR Part 50 require
that (1) measures be provided for verifying or checking the adequacy of design through design reviews,
the use of alternative or simplified calculational methods, or the performance of a suitable testing program
and (2) a test program be established to ensure that systems and components perform satisfactorily
and that the test program include operational tests during nuclear power plant operation.
This regulatory guide is being issued in draft form to involve the public in the early stages of the development of a regulatory position
in this area. It has not received staff review or approval and does not represent an official NRC staff position.
Public comments are being solicited on this draft guide (including any implementation schedule) and its associated regulatory
analysis or value/impact statement. Comments should be accompanied by appropriate supporting data. Written comments may
be submitted to the Rules and Directives Branch, Office of Administration, U.S. Nuclear Regulatory Commission, Washington, DC
20555-0001. Comments may be submitted electronically through the NRC’s interactive rulemaking Web page at
http://www.nrc.gov/what-we-do/regulatory/rulemaking.html. Copies of comments received may be examined at the NRC’s
Public Document Room, 11555 Rockville Pike, Rockville, MD. Comments will be most helpful if received by December 21, 2006.
Requests for single copies of draft or active regulatory guides (which may be reproduced) or placement on an automatic distribution list
for single copies of future draft guides in specific divisions should be made to the U.S. Nuclear Regulatory Commission,
Washington, DC 20555, Attention: Reproduction and Distribution Services Section, or by fax to (301)415-2289; or by email
to [email protected]. Electronic copies of this draft regulatory guide are available through the NRC’s interactive rulemaking
Web page (see above); the NRC’s public Web site under Draft Regulatory Guides in the Regulatory Guides document collection
of the NRC’s Electronic Reading Room at http://www.nrc.gov/reading-rm/doc-collections/; and the NRC’s Agencywide Documents
Access and Management System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html, under Accession No. ML062650307.
10 CFR 50.63, “Loss of All Alternating Current Power,” requires that each light-water-cooled
nuclear power plant must be able to withstand and recover from a station blackout [i.e., loss of offsite
and onsite emergency alternating current (ac) power systems] for a specified duration. The reliability
of onsite ac power sources is one of the main factors contributing to the risk of core melt as a result
of a station blackout.
Most onsite electric power systems use diesel generators as the chosen onsite emergency power
source. This regulatory guide provides guidance that the staff of the U.S. Nuclear Regulatory Commission
(NRC) considers acceptable to comply with the Commission’s regulations for safety-related diesel
generators intended for use as onsite emergency power sources in nuclear power plants — specifically,
that the emergency diesel generators be selected with sufficient capacity, be qualified, and have
the necessary reliability and availability for design-basis events.
The NRC issues regulatory guides to describe to the public methods that the staff considers
acceptable for use in implementing specific parts of the agency’s regulations, to explain techniques
that the staff uses in evaluating specific problems or postulated accidents, and to provide guidance
to applicants. Regulatory guides are not substitutes for regulations, and compliance with regulatory guides
is not required. The NRC issues regulatory guides in draft form to solicit public comment and involve
the public in developing the agency’s regulatory positions. Draft regulatory guides have not received
complete staff review and, therefore, they do not represent official NRC staff positions.
This regulatory guide contains information collections that are covered by the requirements
of 10 CFR Part 50 which the Office of Management and Budget (OMB) approved under OMB control
number 3150-0011. The NRC may neither conduct nor sponsor, and a person is not required to respond to,
an information collection request or requirement unless the requesting document displays a currently
valid OMB control number.
B. DISCUSSION
An emergency diesel generator selected for use in an onsite electric power system should have
the capability to (1) start and accelerate a number of large motor loads in rapid succession, while
maintaining voltage and frequency within acceptable limits, (2) provide power promptly to engineered
safety features if a loss of offsite power and a design-basis event occur during the same time period,
and (3) supply power continuously to the equipment needed to maintain the plant in a safe condition
if an extended loss of offsite power occurs.
The Institute of Electrical and Electronics Engineers (IEEE) Standard 387, 1 “IEEE Standard
Criteria for Diesel-Generator Units Applied as Standby Power Supplies for Nuclear Power Generating
Stations,” issued in 1995 (IEEE Std 387-1995), delineates principal design criteria and qualification
and testing guidelines to ensure that selected diesel generators meet performance requirements.
Working Group SC 4.2 of Subcommittee 4 (Auxiliary Power) of the IEEE Nuclear Power Engineering
Committee developed IEEE Std 387-1995, and the IEEE Standards Board approved the standard
on December 12, 1995.
1
Copies may be obtained from the Institute of Electrical and Electronics Engineers, Inc., IEEE Service Center,
445 Hoes Lane, P.O. Box 1331, Piscataway, NJ 08855.
DG-1172, Page 2
A knowledge of the characteristics of each load is essential to establish the bases for selection
of an emergency diesel generator that is able to accept large loads in rapid succession. The majority
of these emergency loads are large induction motors. At full voltage, this type of motor draws a starting
current of five to eight times its rated full-load current. These sudden large increases in current drawn
from the diesel generator as a result of the startup of induction motors can result in substantial voltage
reductions. This lower voltage could prevent a motor from starting (i.e., accelerating its load to rated speed
in the required time), or could cause a running motor to coast down or stall. Other voltage-sensitive loads
might also be lost because of low voltage or if their associated contactors drop out. Recovery from
the transient caused by starting large motors, or from the loss of a large load, could cause diesel engine
overspeed that, if excessive, might result in a trip of the engine (i.e., loss of the safety-related power source).
These same consequences can also result from the cumulative effect of a sequence of more moderate transients
if the system is not permitted to recover sufficiently between successive steps in a loading sequence.
General industry practice is to specify a voltage reduction of 10–15 percent when starting
large motors from large-capacity power systems, and a maximum voltage reduction of 20–30 percent
when starting these motors from limited-capacity power sources such as diesel generators. Voltage reduction
during load sequencing should be evaluated in light of the plant-specific equipment to prevent
load interruption. Large induction motors can achieve rated speed in less than 5 seconds when powered
from adequately sized emergency diesel generators that are capable of restoring the bus voltage
to 90 percent of nominal in about 1 second.
Protection of the emergency diesel generator from excessive overspeed, which can result from
an improperly adjusted control system or governor failure, is provided by the immediate operation
of a diesel generator trip, which is usually set at 115 percent of nominal speed. Similarly, to prevent
substantial damage to the generator, the generator differential current trip must operate immediately
upon occurrence of an internal fault. Other protective trips can also safeguard the emergency diesel generators
from possible damage. However, these trips could interfere with successful functioning of the diesel
generators when they are most needed (i.e., during design-basis events).
In addition, experience has shown that on numerous occasions, these protective trips have
needlessly shut down emergency diesel generators because of spurious operation of a trip circuit.
Consequently, it is important to take measures to ensure that spurious actuation of these other protective
trips does not prevent the emergency diesel generators from performing their safety function during
the emergency mode of operation.
The uncertainties inherent in safety load estimates at an early stage of design or prior to
the combined license stage are sometimes of such magnitude that it is prudent to provide a reasonable
margin in selecting the load capabilities of the emergency diesel generators. This margin can be provided
by estimating the loads conservatively and selecting the continuous rating of the emergency diesel
generators that exceeds the sum of the loads needed at any one time. A more accurate estimate of safety
loads is possible during the operating license or combined license stages of review because detailed designs
have been completed and component test and preoperational test data are usually available. However,
the design-basis event loads during the operating license or combined license stages should be within
the continuous rating of the emergency diesel generators with margin.
DG-1172, Page 3
The reliability of emergency diesel generators is one of the main factors affecting the risk
of core damage from a station blackout event. Thus, both attaining and maintaining the high reliability
of emergency diesel generators at nuclear power plants contribute greatly to reducing the probability
of station blackout. Regulatory Guide 1.155, “Station Blackout,” issued August 1988, calls for the use
of the reliability of the diesel generator as one of the factors in determining the length of time a plant
should be able to cope with a station blackout. 2 If all other factors (i.e., redundancy of emergency
diesel generators, frequency of loss of offsite power, and probable time needed to restore offsite power)
remain constant, a higher reliability of the diesel generators will result in a lower probability of a total
loss of ac power (station blackout), with a corresponding decrease in coping duration for certain plants.
The design of the emergency diesel generators should also incorporate high operational reliability,
and this high reliability should be maintained throughout their lifetime by initiating a reliability program
that is designed to monitor, improve, and maintain reliability. Increased operational reliability can be
achieved through appropriate testing and maintenance, as well as an effective root cause analysis of all
emergency diesel generator failures.
This guide provides explicit guidance in the areas of preoperational testing, periodic testing,
reporting and recordkeeping requirements, and valid demands and failures. The preoperational
and periodic testing provisions set forth in this guide provide a basis for taking the corrective actions
needed to maintain high inservice reliability of installed emergency diesel generators. The database
developed will assist ongoing performance monitoring for all emergency diesel generators
after installation and during service.
Clause 2 of IEEE Std 387-1995 references several industry codes and standards. If a referenced
standard has been separately incorporated into the NRC’s regulations, licensees and applicants must comply
with that standard as set forth in the regulations. Similarly, if the NRC staff has endorsed a referenced
standard in a regulatory guide, that standard constitutes an acceptable method of meeting a regulatory
requirement as described in the given regulatory guide. Conversely, if a referenced standard has been
neither incorporated into the NRC’s regulations nor endorsed in a regulatory guide, licensees and applicants
may consider and use the information in the referenced standard, if appropriately justified, consistent with
regulatory practice.
2
Regulatory Guide 1.155 is available electronically through the NRC’s Agencywide Documents Access and Management
System (ADAMS) at http://www.nrc.gov/reading-rm/adams.html, under Accession #ML003740034. Single copies
may also be obtained free of charge by writing the Reproduction and Distribution Services Section, ADM, USNRC,
Washington, DC 20555-0001, or by fax to (301) 415-2289, or by email to [email protected]. Regulatory
Guide 1.155 may also be purchased from the National Technical Information Service (NTIS). Details may be obtained
by contacting NTIS at 5285 Port Royal Road, Springfield, Virginia 22161, online at http://www.ntis.gov, or by
telephone at (703) 487-4650. Copies are also available for inspection or copying for a fee from the NRC’s Public
Document Room (PDR), which is located at 11555 Rockville Pike, Rockville, Maryland; the PDR’s mailing address
is USNRC PDR, Washington, DC 20555-0001. The PDR can also be reached by telephone at (301) 415-4737
or (800) 397-4205, by fax at (301) 415-3548, and by email to [email protected].
DG-1172, Page 4
C. REGULATORY POSITION
Conformance with the guidelines in IEEE Std 387-1995 constitutes an acceptable method
for satisfying the Commission’s regulations with respect to the design, qualification, and periodic testing
of diesel generators used as onsite electric power systems for nuclear power plants, subject to
the following exceptions.
1.
Design Considerations
The following regulatory positions supplement the guidelines of IEEE Std 387-1995,
as they relate to design considerations:
1.1
Clause 1.1.1, “Inclusions,” of IEEE Std 387-1995 should be supplemented to include
diesel generator auto controls, manual controls, and diesel generator output breaker.
1.2
When the characteristics of the required emergency diesel generator loads are not accurately known,
such as during an early stage of design, each emergency diesel generator selected for an onsite
power supply system should have a continuous load rating (as defined in Section 3.2 of IEEE
Std 387-1995) equal to the sum of the conservatively estimated connected loads (nameplate rating)
that the diesel generator would power at any one time, plus a 10- to 15-percent margin.
In the absence of fully substantiated performance characteristics for mechanical equipment
such as pumps, the electric motor drive ratings should be calculated using conservative estimates
of these characteristics (e.g., pump runout conditions and motor efficiencies of 90 percent or less,
and power factors of 85 percent or less).
1.3
During the operating license or combined license stages of review, the design-basis event loads
should be within the continuous rating (as defined in Section 3.2 of IEEE Std 387-1995)
of the diesel generator with margin.
1.4
Clause 4.1.2 of IEEE Std 387-1995 pertains, in part, to the starting and load-accepting capabilities
of the diesel generator. In conformance with Clause 4.1.2, each diesel generator should be
capable of starting and accelerating to rated speed, in the required sequence, all the needed
engineered safety features and emergency shutdown loads. The diesel generator should be
designed such that the frequency will not decrease, at any time during the loading sequence,
to less than 95 percent of nominal and the voltage will not decrease to less than 75 percent
of nominal. (A larger decrease in voltage and frequency may be justified for a diesel generator
that carries only one large connected load.) Frequency should be restored to within 2 percent
of nominal in less than 60 percent of each load-sequence interval for a stepload increase,
and less than 80 percent of each load-sequence interval for disconnection of the single largest load.
Voltage should be restored to within 10 percent of nominal within 60 percent of each
load-sequence interval. The acceptance value of the frequency and voltage should be based on
plant-specific analysis to prevent load interruption. (A greater percentage of the load-sequence
interval may be used if it can be justified by analysis. However, the load-sequence interval
should include sufficient margin for the accuracy and repeatability of the load-sequence timer.)
The acceptable values of the frequency and voltage should be based on plant-specific analysis
to prevent load interruption. During recovery from transients caused by disconnection
of the largest single load, the speed of the diesel generator should not exceed the nominal speed
plus 75 percent of the difference between nominal speed and the overspeed trip set point,
or 115 percent of nominal (whichever is lower). Furthermore, the transient following a complete
loss of load should not cause the diesel generator speed to reach the overspeed trip set point.
DG-1172, Page 5
1.5
Emergency diesel generators should be designed so that they can be tested as described
in Regulatory Position 2. The design should allow testing of the diesel generators to simulate
the parameters of operation (e.g., manual start, automatic start, load sequencing, load shedding,
operation time), normal standby conditions, and environments (e.g., temperature, humidity)
that would be expected if actual demand were placed on the system. If prelubrication systems
or prewarming systems designed to maintain lube oil and jacket water cooling at certain
temperatures (or both) are normally in operation, this would constitute normal standby conditions
for the given plant.
1.6
Design provisions should include the capaability to test each emergency diesel generator
independently of the redundant units. Test equipment should not cause a loss of independence
between redundant diesel generators or between diesel generator load groups. Testability should be
considered in selecting and locating instrumentation sensors and critical components
(e.g., governor, starting system components). Instrumentation sensors should be readily accessible
and designed so that their inspection and calibration can be verified in place. The overall design
should include status indication and alarm features.
1.7
In addition, Clause 4.1.2(a) of IEEE Std 387-1995 states, “The unit shall be capable of operating
during and after any design-basis event without support from the preferred power supply.”
This should be consistent with plant-specific conditions.
1.8
Clause 4.5.3.1 of IEEE Std 387-1995 pertains to status indication of diesel generator
unit conditions. The following paragraphs should supplement the guidance in this clause:
1.9
1.8.1
A surveillance system should be provided with a remote indication in the control room
to display emergency diesel generator status (i.e., under test, ready-standby, lockout).
A means of communication should also be provided between diesel generator testing
locations and the main control room to ensure that the operators know the status
of the diesel generator under test.
1.8.2
To facilitate the diagnosis of trouble, the surveillance system should indicate
which of the emergency diesel generator protective trips has been activated first.
The following should supplement Clause 4.5.4 of IEEE Std 387-1995, which pertains to
bypassing emergency diesel generator protective trips during emergency conditions:
The emergency diesel generator should be tripped automatically on engine overspeed
and generator-differential overcurrent. All other diesel generator protective trips should be
handled in one of the following two ways:
(1)
A trip should be implemented with two or more measurements for each trip parameter
with coincident logic provisions for trip actuation.
(2)
A trip may be bypassed under design-basis events, provided the operator has sufficient time
to react appropriately to an abnormal diesel generator condition.
The design of the coincident logic trip circuitry should include the capability to indicate individual
sensor trips. The design of the bypass circuitry should include the capability to (1) test the status
and operability of the bypass circuits, (2) trigger alarms in the control room for abnormal values
of all bypass parameters (common trouble alarms may be used), and (3) manually reset the trip
bypass function. The capability to automatically reset the bypass function is not acceptable.
Clause 4.5.4(b) of IEEE Std 387-1995, which pertains to retaining all protective devices
during emergency diesel generator testing, does not apply to periodic tests (SIAS, combined with
SIAS and LOOP, and Protective Trip Bypass) that demonstrate diesel generator system response
under simulated design-basis events.
DG-1172, Page 6
1.8
Clause 4.5.2.2 of IEEE Std 387-1995 should be modified to read as follows:
Upon receipt of an emergency start-diesel signal, the automatic control system shall provide
automatic startup and automatic adjustment of speed and voltage to a ready-to-load condition
in the emergency (isochronous) mode.
2.
Diesel Generator Testing
Clauses 3, 5, 6, and 7 of IEEE Std 387-1995 should be supplemented as discussed below.
2.1
Definitions
Figure 1 illustrates those components and systems that should be considered to be within
the emergency diesel generator boundary when evaluating failures. Systems that support the emergency
diesel generator and perform other plant functions are depicted as being outside this boundary.
IEEE Std 387-1995 provides similar definitions of components and system boundaries and may also
be used as guidance; however, generator breakers must be considered as part of the diesel generator
boundary.
The following definitions apply to the regulatory positions that address testing, recordkeeping,
and reporting of emergency diesel generator performance:
Start demands: All valid and inadvertent start demands, including all start-only demands and all start
demands that are followed by load-run demands, whether by automatic or manual initiation, are start
demands. In a start-only demand, the emergency diesel generator is started, but no attempt is made
to load the emergency diesel generator (see the exceptions below).
Start failures: Any failure within the emergency diesel generator system that prevents the generator
from achieving a specified frequency (or speed) and voltage is classified as a valid start failure.
(For monthly surveillance tests, the emergency diesel generator can be brought to rated speed and voltage
in the time recommended by the manufacturer to minimize stress and wear.) Any condition identified
during maintenance inspections (with the emergency diesel generator in the standby mode) that would
definitely have resulted in a start failure if a demand had occurred should count as a valid start demand
and failure.
Load-run demands: To be valid, the load-run attempt must follow a successful start and meet
one of the following criteria (see the exceptions below):
•
a load-run of any duration that results from a real (i.e., not a test) automatic or manual signal
•
a load-run test to satisfy the plant’s load and duration test specifications
•
other operations (e.g., special tests) in which the emergency diesel generator is planned to run
for at least 1 hour with at least 50 percent of design load
Load-run failures: A load-run failure should be counted when the emergency diesel generator starts
but does not pick up the load and run successfully. Any failure during a valid load-run demand
should count (see the exceptions below). (For monthly surveillance tests, the emergency diesel generator
can be loaded at the rate recommended by the manufacturer to minimize stress and wear.) Any condition
identified during maintenance inspections (with the emergency diesel generator in the standby mode)
that definitely would have resulted in a load-run failure if a demand had occurred should count as
a valid load-run demand and failure.
DG-1172, Page 7
DG-1172, Page 8
Exceptions: Unsuccessful attempts to start or load-run should not count as valid demands or failures
when they can definitely be attributed to any of the following:
•
any operation of a trip that would be bypassed in the emergency operation mode
(e.g., high cooling-water temperature trip)
•
malfunction of equipment that is not required to operate during the emergency operating mode
(e.g., synchronizing circuitry)
•
intentional termination of the test because of alarmed or observed abnormal conditions
(e.g., small water or oil leaks) that would not have ultimately resulted in significant damage
or failure of the emergency generator
•
component malfunctions or operating errors that did not prevent the emergency diesel generator
from being restarted and brought to load within a few minutes (i.e., without corrective maintenance
or significant problem diagnosis)
•
a failure to start because a portion of the starting system was disabled for test purposes,
if followed by a successful start with the starting system in its normal alignment
Each diesel generator valid failure that results in declaration of the emergency diesel generator
as being inoperable should count as one demand and one failure. Exploratory tests during corrective
or preventive maintenance should not count as demands or failures. However, the successful test
that is performed to declare the emergency diesel generator operable should count as a demand.
2.2
Test Descriptions
The table on site testing from the standard is repeated in this guide as Table 1 to address
supplementary guidance when required. The following test descriptions should be used in conjunction
with the preoperational and surveillance testing described in the table. The licensee should have detailed
procedures for each test described herein. The procedures should identify special arrangements
or changes in normal system configuration that must be made to put the emergency diesel generator
under test. Jumpers and other nonstandard configurations or arrangements should not be used
after initial equipment startup testing.
2.2.1
Starting Test
Clause 7.2.1.1 should be supplemented as follows:
The acceptance criteria for frequency and voltage should be equal to or higher than the minimum
required voltage and frequency for the safety-related loads.
2.2.2
Slow-Start Test
Clause 7.5.1 of IEEE Std 387-1995 should be supplemented as follows:
This test involves demonstrating proper startup from standby conditions, and verify that
the required design voltage and frequency are attained. For this test, the emergency diesel generator
can be slow-started and reach rated speed on a prescribed schedule to minimize stress and wear.
DG-1172, Page 9
Table 1
Tests
Reference:
IEEE 387
Clause:
Site
acceptance
tests
(7.2)*
Preoperational
tests
(7.3)*
Availability tests
(7.4.2..1)*
(Surveillance)
Monthly
6 Month
System
operation
tests:
shutdown/
refueling
(7.4.2.2)*
7.2.1.1
Starting
X
7.2.1.2
Load
acceptance
X
7.2.1.3
Rated Load
X
7.2.1.4
Load Rejection
X
7.2.1.5
Electrical
X
7.2.1.6
Subsystem
X
7.3.3
Reliability
7.5.1
Start
7.5.2
Load Run
X
7.5.3
Fast Start
X
X
7.5.4
LOOP
X
X
7.5.5
SIAS
X
X
7.5.6
Combined
SIAS and
LOOP
X
X
7.5.7
Largest load
rejection
X
X
7.5.8
Design load
rejection
X
X
7.5.9
Endurance and
load margin
Xa
X
7.5.10
Hot restart
X
X
7.5.11
Synchronizing
X
X
7.5.12
Protective trip
bypass
X
X
7.5.13
Test mode
override
X
X
7.5.14
Independence
Instead of 2 h and 6 h, use 2 h and 22 h.
*
IEEE Std. 387 - 1995
X
Independence
tests
10 years
(7.4.2.3)*
X
a
DG-1172, Page 10
X
2.2.3
Load Run (Load Acceptance) Test
Clause 7.5.2 of IEEE Std 387-1995 should be supplemented as follows:
This test involves demonstrating 90–100 percent of the continuous rating or worst case design-basis
event loads (whichever is higher) of the emergency diesel generator, for an interval of not less than
1 hour and until attainment of temperature equilibrium. This test may be accomplished
by synchronizing the generator with offsite power. The loading and unloading of an emergency
diesel generator during this test should be gradual and based on a prescribed schedule that is
selected to minimize stress and wear on the diesel generator.
2.2.4
Rated Load Test
Clause 7.2.1.3 (a) of IEEE Std 387-1995 should be supplemented as follows:
If the design-basis event loads are higher than the continuous rating of the emergency diesel
generator, the test should be conducted at the worst case design-basis event loads.
2.2.5
Loss-of-Offsite-Power (LOOP) Test
Clause 7.5.4 of IEEE Std 387-1995 should be supplemented as follows:
This test involves simulating a loss of offsite power to demonstrate that (1) the emergency buses
are deenergized and the loads are shed from the emergency buses, and (2) the emergency diesel
generator starts on the autostart signal from its standby conditions; attains the required voltage
and frequency, and energizes permanently connected loads within acceptable limits and time;
energizes all autoconnected shutdown loads through the load sequencer; and operates for greater than
or equal to 5 minutes. If the required safety loads are not available, one or more equivalent load(s)
may be used.
2.2.6
Combined Safety Injection Actuation System (SIAS) and Loss-of-Offsite-Power Test
Clause 7.5.6 of IEEE Std 387-1995 should be modified to read as follows:
This test involves demonstrating that emergency diesel generator can satisfactorily respond to
a loss-of-offsite power in conjunction with SIAS in whatever sequence they might occur
(e.g., loss-of-coolant accident followed by delayed loss-of-offsite power or loss-of-offsite power
followed by loss-of-coolant accident). A simultaneous loss-of-offsite-power/loss-of-coolant accident
event would be demonstrated by verifying that the diesel generator unit starts on the auto-start
signal from its standby conditions, attains the frequency and voltage within acceptable limits
and time, energizes the auto-connected shutdown loads through the load sequencer
within the acceptable limits of pump start time, and operates for a minimum of 5 minutes.
2.2.7
Largest Load Rejection Test
Clause 7.5.7 of IEEE Std-1995 should be supplemented as follows:
This test involves demonstrating the emergency diesel generator’s capability to reject a load
equal to loss of the largest single load while operating at largest load power factor and verify that
the frequency and voltage requirements are met and the unit will not trip on overspeed.
DG-1172, Page 11
2.2.8
Design-Load Rejection Test
Clause 7.5.8 of IEEE Std-1995 should be supplemented as follows:
This test involves demonstrating the emergency diesel generator’s capability to reject a load
equal to 90–100 percent of the continuous rating while operating at a worst case design load power
factor and verify that the voltage requirements are met and that the unit will not trip on overspeed.
2.2.9
Endurance and Load Margin Test
Clause 7.5.9 of IEEE Std 387-1995 should be supplemented as follows:
This test involves demonstrating the full load-carrying capability at a worst case design load
power factor for an interval of not less than 24 hours. Of this period, 2 hours are at a load equal to
105–110 percent of the continuous rating or design-basis load with a margin of 5–10 percent
(whichever is higher) of the emergency diesel generator, and 22 hours are at a load equal to
90–100 percent of the generator’s continuous rating. The test process should verify that frequency
and voltage requirements are maintained.
2.2.10 Hot Restart Test
Clause 7.5.10 of IEEE Std 387-1995 should be supplemented as follows:
This test involves demonstrating the hot restart functional capability at full load-temperature
conditions (after the emergency diesel generator has operated for 2 hours at continuous or design-basis
event loads whichever is higher) by verifying that the emergency diesel generator starts on a manual
or auto-start signal, attains the required frequency and voltage within acceptable limits and time,
and operates for longer than 5 minutes. This test may be performed following the endurance
and margin test described above.
2.2.11 Periodic-Trip Bypass Test
Clause 7.5.12 of IEEE Std 387-1995 should be supplemented as follows:
This test involves demonstrating that automatic diesel generator unit trips are automatically
bypassed as designed. Typically, engine overspend, generator differential current trip and those
trips retained with coincident logic are not bypassed. This test should also verify that the critical
protective trips that are not automatically bypassed perform their intended function.
2.3
Preoperational and Surveillance Testing
Table 1 relates preoperational and surveillance tests to the anticipated schedule for performance
(e.g., preoperational, monthly surveillance, 6-month testing, scheduled refueling period, and 10-year testing).
A prelube period should precede all planned tests described in this regulatory guide. The tests should be
in general accordance with the manufacturer’s recommendations for reducing engine wear, including
cooldown operation at reduced power followed by postoperation lubrication.
2.3.1
Preoperational Testing
A preoperational test program should be implemented for all emergency diesel generator systems
following assembly and installation at the site. This program should include the tests identified in Table 1.
In addition, through a minimum of 25 valid start and load demands without failure on each
installed emergency diesel generator, this test should demonstrate that the new emergency diesel generator
has attained a level of reliability acceptable for entering into an operational category.
DG-1172, Page 12
2.3.2
Surveillance Testing
After plants are licensed (after fuel load), periodic surveillance testing of each emergency diesel
generator should demonstrate the continued capability and reliability of the diesel generator unit
to perform its intended function. When the emergency diesel generator is declared operational
in accordance with the plant’s technical specifications, the following periodic test program should be
implemented.
2.3.2.1 Monthly Testing
After completion of the reliability demonstration during preoperational testing, the emergency
diesel generators should be periodically tested during normal plant operation. Each diesel generator
should be started as described in Regulatory Position 2.2.2 and loaded as described in Regulatory
Position 2.2.3 at least once every 31 days (with the maximum allowable extension not to exceed
25 percent of the surveillance interval).
2.3.2.2 Six-Month (or 184-Day) Testing
This test may substitute for a monthly test. To demonstrate the capability of the emergency diesel
generator to start from standby conditions and provide the necessary power to mitigate a loss-of-coolant
accident coincident with a loss of offsite power, each diesel generator should be started from standby
conditions once every 6 months as described in Clause 7.5.3 of IEEE Std 387-1995. This will verify
that the diesel generator reaches the required voltage and frequency within acceptable limits and time
as specified in the plant technical specifications. Following this test, the emergency diesel generator
should be loaded as described in Clause 7.5.2 of IEEE Std 387-1995 (see also Table 1).
2.3.2.3 Refueling Outage Testing
The capability of the overall emergency diesel generator design should be demonstrated
during every refueling outage (or at a frequency of not more than every 24 months) by performing
the tests identified in Table 1. Certain tests may be conducted during the operating mode with NRC
approval if the tests can be safely performed without increasing the probability of plant trip, loss of power
to the safety buses, or loss of offsite power.
2.3.2.4 Ten-Year Testing
This testing involves demonstrating that the trains of standby electric power are independent
at a frequency of once every 10 years (during a plant shutdown) or after any modifications that could
affect emergency diesel generator independence (whichever is shorter) by starting all redundant units
simultaneously to identify certain common-failure modes undetected in single diesel generator unit tests
(see also Table 1).
3.
Reporting Criteria
Licensees must conform to the reporting requirements of 10 CFR Part 21, “Reporting of Defects
and Noncompliance”; 10 CFR 50.72, “Immediate Notification Requirements for Operating Nuclear
Power Reactors”; and 10 CFR 50.73, “License Event Reporting System.”
DG-1172, Page 13
D. IMPLEMENTATION
The purpose of this section is to provide information to applicants and licensees regarding
the NRC staff’s plans for using this draft regulatory guide. No backfitting is intended or approved
in connection with its issuance.
The NRC has issued this draft guide to encourage public participation in its development.
Except in those cases in which an applicant or licensee proposes or has previously established
an acceptable alternative method for complying with specified portions of the NRC’s regulations,
the methods to be described in the active guide will reflect public comments and will be used
in evaluating (1) submittals in connection with applications for construction permits,
standard plant design certifications, operating licenses, early site permits, and combined licenses;
and (2) submittals from operating reactor licensees who voluntarily propose to initiate
system modifications involving diesel generators used as onsite emergency electric power systems.
DG-1172, Page 14
REGULATORY ANALYSIS
1.
Statement of the Problem
The U.S. Nuclear Regulatory Commission (NRC) issued Revision 3 of Regulatory Guide 1.9
in July 1993 to provide the principal design criteria, as well as testing and qualification requirements
for the safety-related diesel generators used in nuclear power plants as the power source. That revision
endorsed IEEE Std 387-1984, “Standard Criteria for Diesel Generator Units Applied as Standby Power
Supplies for Nuclear Power Generating Stations.” The IEEE revised this standard in 1995
(IEEE Std 387-1995) to reflect the current state-of-the-technology. Therefore, the NRC should revise
this regulatory guide to endorse IEEE Std 387-1995, as appropriate.
2.
Objective
The objective of this action is to provide current guidance for application and testing of safetyrelated diesel generators.
3.
Technical Approach
Issuing a revised regulatory guide is consistent with the NRC’s policy of evaluating the latest versions
of national consensus standards in terms of their suitability for endorsement in regulatory guides.
Revision 4 of this regulatory guide would endorse IEEE Std 387-1995 with a few specific exceptions.
As such, this revision would provide a standardized approach to ensure that the nuclear industry
and the NRC staff have a common understanding of the criteria for application and testing of diesel
generators in nuclear power plants. IEEE Std 387-1995 provides additional detail in the following areas:
(1)
defining specific qualification requirements
(2)
clarifying the scope and scope diagram
(3)
providing requirements for no-load and light-load operation, since extended operation
under these conditions may be detrimental to unit performance
(4)
expanding factory production testing and site testing criteria
(5)
updating specific surveillance requirements
(6)
providing guidance for test parameters
(7)
providing guidance for reliability program elements
(8)
periodic testing requirements
In addition, many of the NRC exceptions delineated in Regulatory Guide 1.9, Revision 3,
were incorporated in IEEE Std 387-1995.
4.
Conclusion
The NRC should issue Revision 4 of Regulatory Guide 1.9 to enhance the licensing process.
The staff has concluded that the proposed action will reduce unnecessary burden on both the NRC
and its licensees, and will result in an improved process for using safety-related diesel generators
in nuclear power plants. Moreover, the staff sees no adverse effects associated with issuing this revision.
Use of this revision by licensees of currently operating nuclear power plants is entirely voluntary.
BACKFIT ANALYSIS
As described in 10 CFR 50.109(c), this draft regulatory guide does not require a backfit analysis
because the use of this revision by licensees of currently operating nuclear plower plants is voluntary.
DG-1172, Page 15
Fly UP